{
  "markdown": "# Skill Vetting (ClawHub)\n\nSecurity‑first vetting protocol for OpenClaw/ClawHub skills. The goal is to prevent installing untrusted skills by enforcing code review, scope checks, and a standardized risk report.\n\n## What it does\n- Forces **code review** (SKILL.md alone is not enough)\n- Detects **red flags** (exfiltration, obfuscation, exec/eval, secrets access)\n- Checks **recent activity** to catch supply‑chain risks\n- Enforces **permission scope** and explicit domain listing\n- Produces a **standard report** with a **confidence score (0–100)**\n\n## Files\n- `SKILL.md` — the skill instructions and workflow\n- `references/vetting-guide.md` — full checklist, commands, red flags, report template\n\n## How to use (in OpenClaw)\nAsk the agent to vet a skill:\n```\nVet this ClawHub skill: <link>\n```\n\nThe output will be a **SKILL VETTING REPORT** with:\n- Metrics (downloads, last update, files reviewed)\n- Red flags\n- Permissions needed\n- Confidence score + risk level\n- Final verdict\n\n## Hard rules\n- **SKILL.md is not enough** — provide the code for a final verdict\n- If in doubt → **do not install**\n\n## Confidence score\nWeighted rubric (0–100):\n- Provenance/author (0–25)\n- Code transparency (0–25)\n- Permission scope (0–20)\n- Network risk (0–15)\n- Community signals (0–15)\n\nThresholds:\n- 80–100 → ✅ OK (sandbox still recommended)\n- 60–79 → ⚠️ Caution (sandbox + read‑only for non‑sensitive paths)\n- <60 → ❌ No‑go\n\n## Notes\nThis skill is preventive. It reduces risk but does not guarantee safety.\n",
  "bytes": 1496,
  "sha": "903d8926096279aa1783694ce5da0ba2b866b3acb1a872998db2a1112e25750a",
  "repo_slug": "hugomrtz/skill-vetting-clawhub",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/skl_hugomrtz_skill_vetting_clawhub_clawhub_s_ca8e5b18/readme"
}